Skip to content

fix: enforce static architecture policy contracts - #1059

Merged
kang-heewon merged 1 commit into
trunkfrom
fix/931-architecture-policy
Jun 21, 2026
Merged

fix: enforce static architecture policy contracts#1059
kang-heewon merged 1 commit into
trunkfrom
fix/931-architecture-policy

Conversation

@kang-heewon

@kang-heewon kang-heewon commented Jun 21, 2026

Copy link
Copy Markdown
Member

Summary

  • Adds @croco/architecture-policy and the repo croco.arch.json gate for package/layer boundaries, forbidden imports, manifest dependencies, and public entrypoint imports.
  • Exposes croco architecture-policy check through @croco/cli and runs the repo gate in pnpm check.
  • Emits generated SaaS app croco.arch.json manifests and runs the policy gate in generated demo smoke.

Verification

  • pnpm --filter @croco/architecture-policy test
  • pnpm --filter @croco/architecture-policy typecheck
  • pnpm architecture-policy:check
  • pnpm check
  • pnpm changeset-required:check
  • pnpm exec turbo run build --filter=@croco/architecture-policy --filter=@croco/cli --filter=create-croco-app
  • pnpm create-croco-app:smoke
  • pre-push: pnpm test, pnpm typecheck

Summary by CodeRabbit

๋ฆด๋ฆฌ์Šค ๋…ธํŠธ

  • ์ƒˆ๋กœ์šด ๊ธฐ๋Šฅ
    • ์ •์  ์•„ํ‚คํ…์ฒ˜ ์ •์ฑ…์„ ๋งค๋‹ˆํŽ˜์ŠคํŠธ ๊ธฐ๋ฐ˜์œผ๋กœ ์ ๊ฒ€ํ•˜๋Š” ์—”์ง„ ์ถ”๊ฐ€
    • croco architecture-policy check ๋ช…๋ น ๋ฐ --json ๋ฆฌํฌํŠธ ์ง€์›
    • ์ƒ์„ฑ๋œ SaaS ์•ฑ์— croco.arch.json์ด ํฌํ•จ๋˜๊ณ , ์ƒ์„ฑ ๊ณผ์ • ์ ๊ฒ€ ๋‹จ๊ณ„์— ์ž๋™ ์ถ”๊ฐ€
  • ๋ฌธ์„œ
    • ์•„ํ‚คํ…์ฒ˜ ์ •์ฑ… ๋™์ž‘/์—ญํ•  ๋ฌธ์„œํ™”, ํŒจํ‚ค์ง€ ์นดํƒˆ๋กœ๊ทธ์— ํ•ญ๋ชฉ ๋ฐ˜์˜
    • ๋ฌธ์ œ ์ฝ”๋“œ ๋ ˆ์ง€์ŠคํŠธ๋ฆฌ ๋ฐ ๊ณต๊ฐœ ์•ˆ๋‚ด ๊ฐฑ์‹ 
  • ํ…Œ์ŠคํŠธ
    • ์—”์ง„/CLI/E2E ์ƒ์„ฑ ํ๋ฆ„ ๊ฒ€์ฆ ์ผ€์ด์Šค ์ถ”๊ฐ€

@coderabbitai

coderabbitai Bot commented Jun 21, 2026

Copy link
Copy Markdown

Review Change Stack

Warning

Review limit reached

@kang-heewon, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 45 minutes. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running โ€” you're only billed for reviews past your plan's rate limits ($0.25/file).

โŒ› How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

๐Ÿšฆ How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

โ„น๏ธ Review info
โš™๏ธ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 99a9b741-6f3a-40b7-a212-e6698c7d45f1

๐Ÿ“ฅ Commits

Reviewing files that changed from the base of the PR and between 8457dc3 and 6f86fb4.

โ›” Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
๐Ÿ“’ Files selected for processing (33)
  • .changeset/static-architecture-policy.md
  • README.md
  • croco.arch.json
  • docs/architecture-policy.md
  • docs/package-catalog.json
  • docs/package-docs-baseline.json
  • docs/package-docs-report.md
  • docs/problem-code-registry.json
  • package.json
  • packages/architecture-policy/README.md
  • packages/architecture-policy/package.json
  • packages/architecture-policy/src/index.ts
  • packages/architecture-policy/src/tests/ArchitecturePolicy.spec.ts
  • packages/architecture-policy/tsconfig.json
  • packages/cli/package.json
  • packages/cli/src/commands/architecturePolicy.ts
  • packages/cli/src/commands/root.ts
  • packages/cli/src/index.ts
  • packages/cli/src/tests/architecturePolicyCheck.spec.ts
  • packages/cli/vitest.config.ts
  • packages/create-croco-app/src/generator.ts
  • packages/create-croco-app/src/tests/e2e-generation.spec.ts
  • packages/create-croco-app/src/tests/templates-build.spec.ts
  • packages/create-croco-app/templates/saas/package.json.hbs
  • packages/docs/src/content/docs/en/guides/getting-started.mdx
  • packages/docs/src/content/docs/en/index.mdx
  • packages/docs/src/content/docs/en/reference/problem-recovery-cookbook.md
  • public-api-surface.snapshot.json
  • scripts/architecture-policy-check.mts
  • scripts/create-croco-app-generated-smoke.mts
  • scripts/package-entrypoint-smoke.mts
  • scripts/package-quality-report.mts
  • scripts/tests/package-entrypoint-smoke.spec.ts
๐Ÿ“ Walkthrough

๊ฐœ์š”

@croco/architecture-policy ํŒจํ‚ค์ง€๋ฅผ ์‹ ๊ทœ ์ถ”๊ฐ€ํ•˜์—ฌ ๋งค๋‹ˆํŽ˜์ŠคํŠธ ํŒŒ์‹ฑ, ๊ธˆ์ง€ importยทํ—ˆ์šฉ ๊ทธ๋ฃน ์—ฃ์ง€ยทpublic entrypoint ์„ธ ๊ฐ€์ง€ ๊ทœ์น™ ์—”์ง„์„ ๊ตฌํ˜„ํ•œ๋‹ค. @croco/cli์— architecture-policy check ์„œ๋ธŒ์ปค๋งจ๋“œ๋ฅผ ์—ฐ๊ฒฐํ•˜๊ณ , ๋ฃจํŠธ check ์Šคํฌ๋ฆฝํŠธ์— ํฌํ•จ์‹œํ‚ค๋ฉฐ, create-croco-app SaaS ์ƒ์„ฑ๊ธฐ๊ฐ€ croco.arch.json์„ ์ž๋™ ์ƒ์„ฑํ•˜๋„๋ก ํ™•์žฅํ•œ๋‹ค.

๋ณ€๊ฒฝ์‚ฌํ•ญ

์ •์  ์•„ํ‚คํ…์ฒ˜ ์ •์ฑ… ์—”์ง„ ๋ฐ CLI ๊ฒŒ์ดํŠธ

๋ ˆ์ด์–ด / ํŒŒ์ผ(๋“ค) ์š”์•ฝ
์—”์ง„ ๊ณต๊ฐœ ํƒ€์ž…ยท๋งค๋‹ˆํŽ˜์ŠคํŠธ ํŒŒ์‹ฑยท๊ทœ์น™ ์‹คํ–‰๊ธฐ
packages/architecture-policy/src/index.ts
ArchitecturePolicyManifest, ๊ทœ์น™/์ง„๋‹จ ํƒ€์ž…์„ ์ •์˜ํ•˜๊ณ , parseArchitecturePolicyManifest๊ฐ€ schemaVersion์„ ๊ฒ€์ฆํ•œ ๋’ค JSON์„ ๊ตฌ์กฐํ™”๋œ ๋งค๋‹ˆํŽ˜์ŠคํŠธ๋กœ ๋ณ€ํ™˜ํ•œ๋‹ค. checkArchitecturePolicy๊ฐ€ forbiddenImports/allowedGroupImports/publicEntrypoints ๊ทœ์น™์„ ์‹คํ–‰ํ•˜๊ณ , matcherยทwildcardยทํŒจํ‚ค์ง€ ๊ทธ๋ฃนยทspecifier ๋ถ„๋ฆฌยท์ฃผ์„ ์ œ๊ฑฐยทexport subpath ๊ณต๊ฐœ ์—ฌ๋ถ€ ๊ฒ€์‚ฌ ๋“ฑ ๋ณด์กฐ ๋กœ์ง์œผ๋กœ ์ •ํ™•ํ•œ ImportContext๋ฅผ ๊ตฌ์„ฑํ•ด ์ง„๋‹จ์„ ์ƒ์„ฑํ•˜๋ฉฐ pass/fail ๋ฆฌํฌํŠธ๋ฅผ ๋ฐ˜ํ™˜ํ•œ๋‹ค.
์—”์ง„ ํŒจํ‚ค์ง€ ์„ค์ • ๋ฐ ๋ฌธ์„œ
packages/architecture-policy/package.json, packages/architecture-policy/tsconfig.json, packages/architecture-policy/README.md
packages/architecture-policy์˜ ESM ์„ค์ •, ๋ฐฐํฌ ์ง„์ž…์ , ๋นŒ๋“œ/๋ฆฐํŠธ/ํ…Œ์ŠคํŠธ/ํƒ€์ž…์ฒดํฌ ์Šคํฌ๋ฆฝํŠธ๋ฅผ ๊ตฌ์„ฑํ•˜๊ณ , ๊ฒ€์ฆ ๋ฒ”์œ„์™€ CLI ์‚ฌ์šฉ ์˜ˆ์‹œ๋ฅผ ๋ฌธ์„œํ™”ํ•œ๋‹ค.
์—”์ง„ ์œ ๋‹› ํ…Œ์ŠคํŠธ
packages/architecture-policy/src/tests/ArchitecturePolicy.spec.ts
์ž„์‹œ ๋ฆฌํฌ์ง€ํ† ๋ฆฌ๋กœ ๊ธˆ์ง€ import ์ง„๋‹จ ์œ„์น˜ ์ •ํ™•์„ฑ, ๊ทธ๋ฃน ์—ฃ์ง€ ํŒ์ •, private entrypoint ์ฐจ๋‹จ, ์ง„๋‹จ ์ •๋ ฌ, schemaVersion ์˜ค๋ฅ˜ ์˜ˆ์™ธ๋ฅผ ๊ฒ€์ฆํ•œ๋‹ค.
CLI architecture-policy check ์ปค๋งจ๋“œ ๋ฐ ๋ผ์šฐํŒ…
packages/cli/package.json, packages/cli/src/commands/architecturePolicy.ts, packages/cli/src/commands/root.ts, packages/cli/src/index.ts, packages/cli/vitest.config.ts
ArchitecturePolicyCheckIo ์ธํ„ฐํŽ˜์ด์Šค๋ฅผ ์ •์˜ํ•˜๊ณ , defineCommand๋กœ architecture-policy/check ๊ณ„์ธต์„ ๋“ฑ๋กํ•œ๋‹ค. runArchitecturePolicyCheck๊ฐ€ ์ธ์ž ํŒŒ์‹ฑ โ†’ ๋งค๋‹ˆํŽ˜์ŠคํŠธ ๋กœ๋“œ โ†’ ์ •์ฑ… ์ฒดํฌ โ†’ JSON/ํ…์ŠคํŠธ ์ถœ๋ ฅ โ†’ ์ข…๋ฃŒ์ฝ”๋“œ ๋ฐ˜ํ™˜ ํ๋ฆ„์„ ์ˆ˜ํ–‰ํ•˜๋ฉฐ root.ts์— lazyCommand๋กœ ์—ฐ๊ฒฐ๋˜๊ณ  cli/src/index.ts์—์„œ ์žฌ๋‚ด๋ณด๋‚ธ๋‹ค.
CLI ์ปค๋งจ๋“œ ํ…Œ์ŠคํŠธ
packages/cli/src/tests/architecturePolicyCheck.spec.ts
--json ๋ชจ๋“œ pass ์ถœ๋ ฅ, ๊ธˆ์ง€ import ์‹คํŒจ ๊ฐ์ง€(์ข…๋ฃŒ์ฝ”๋“œ 1, ์œ„์น˜ยทrecovery ํฌํ•จ), --manifest ๋ˆ„๋ฝ ์—๋Ÿฌ๋ฅผ ๊ฒ€์ฆํ•œ๋‹ค.
๋ฃจํŠธ check ์Šคํฌ๋ฆฝํŠธยทstandalone CLIยทcroco.arch.json ๋งค๋‹ˆํŽ˜์ŠคํŠธ
package.json, scripts/architecture-policy-check.mts, croco.arch.json
architecture-policy:check๋ฅผ ๋ฃจํŠธ package.json ์Šคํฌ๋ฆฝํŠธ์— ์ถ”๊ฐ€ํ•˜๊ณ  check ๋ณตํ•ฉ ์Šคํฌ๋ฆฝํŠธ์— ํฌํ•จ์‹œํ‚จ๋‹ค. scripts/architecture-policy-check.mts๋Š” ๋…๋ฆฝ ์‹คํ–‰ํ˜• ์ง„์ž…์ ์œผ๋กœ --manifest/--root/--json ์˜ต์…˜์„ ํŒŒ์‹ฑํ•ด ์ •์ฑ… ๊ฒ€์‚ฌ๋ฅผ ์ง์ ‘ ํ˜ธ์ถœํ•œ๋‹ค. croco.arch.json์€ ํ”„๋ ˆ์ž„์›Œํฌ ๋ฆฌํฌ์˜ packageGroups, forbiddenImports(provider/runtime SDK ์ฐจ๋‹จ), publicEntrypoints(๊ณต๊ฐœ entrypoint ๊ฐ•์ œ) ๊ทœ์น™์„ ์„ ์–ธํ•œ๋‹ค.
SaaS ์•ฑ ์ƒ์„ฑ ์‹œ croco.arch.json ์ž๋™ ์ƒ์„ฑ
packages/create-croco-app/src/generator.ts, packages/create-croco-app/templates/saas/package.json.hbs
writeSaasProviderProfileArtifacts๊ฐ€ croco.arch.json์„ ์ž๋™ ์ƒ์„ฑํ•˜๋„๋ก ํ™•์žฅ๋˜๊ณ , createArchitecturePolicyManifest๊ฐ€ allowedGroupImports/publicEntrypoints ๊ทœ์น™์„ ํฌํ•จํ•œ ๋งค๋‹ˆํŽ˜์ŠคํŠธ๋ฅผ ๊ตฌ์„ฑํ•œ๋‹ค. SaaS ํ…œํ”Œ๋ฆฟ demo:smoke ์ฒด์ธ์— architecture-policy:check๊ฐ€ ์ถ”๊ฐ€๋œ๋‹ค.
SaaS ์ƒ์„ฑ๊ธฐ ํ…Œ์ŠคํŠธ ๋ฐ ์Šค๋ชจํฌ ๋ฒ”์œ„ ์˜ค๋ฒ„๋ผ์ด๋“œ
packages/create-croco-app/src/tests/e2e-generation.spec.ts, packages/create-croco-app/src/tests/templates-build.spec.ts, scripts/create-croco-app-generated-smoke.mts
croco.arch.json ํŒŒ์ผ ์กด์žฌ ํ™•์ธ, manifest toMatchObject ๊ฒ€์ฆ, demo:smoke ์ฒด์ธ ์ˆœ์„œ ๊ฒ€์ฆ์„ ์ถ”๊ฐ€ํ•˜๊ณ , ์Šค๋ชจํฌ ๋ฒ”์œ„ ์˜ค๋ฒ„๋ผ์ด๋“œ์— @croco/architecture-policy๋ฅผ ๋“ฑ๋กํ•œ๋‹ค.
๊ณต๊ฐœ API ์Šค๋ƒ…์ƒทยท์•„ํ‚คํ…์ฒ˜ ์ •์ฑ… ๋ฌธ์„œยท์นดํƒˆ๋กœ๊ทธ ๊ฐฑ์‹ 
public-api-surface.snapshot.json, docs/architecture-policy.md, README.md, docs/package-catalog.json, docs/package-docs-*.json, docs/problem-code-registry.json, packages/docs/src/content/docs/en/reference/problem-recovery-cookbook.md, scripts/package-quality-report.mts, .changeset/static-architecture-policy.md
์‹ ๊ทœ ํŒจํ‚ค์ง€์˜ ๊ณต๊ฐœ API ์Šค๋ƒ…์ƒท์„ ๋“ฑ๋กํ•˜๊ณ , ์•„ํ‚คํ…์ฒ˜ ์ •์ฑ… ๋ฌธ์„œ๋ฅผ ์ž‘์„ฑํ•œ๋‹ค. ์นดํƒˆ๋กœ๊ทธ/๋ฌธ์„œ์—์„œ public ํŒจํ‚ค์ง€ ์ˆ˜(108โ†’109), beta ํŒจํ‚ค์ง€ ์ˆ˜(51โ†’52)๋ฅผ ๊ฐฑ์‹ ํ•˜๋ฉฐ, ์ง„๋‹จ ์ฝ”๋“œ๋ฅผ ์ถ”๊ฐ€ํ•˜๊ณ  blocking gates ๋ชฉ๋ก์„ ๋ฐ˜์˜ํ•œ๋‹ค.
ํ—ฌํผ ์Šคํฌ๋ฆฝํŠธ ์—…๋ฐ์ดํŠธ
scripts/package-entrypoint-smoke.mts, scripts/tests/package-entrypoint-smoke.spec.ts
ํƒ€์ž… ์„ ์–ธ import ์ˆ˜์ง‘ ๋กœ์ง์„ collectDeclarationImportSpecifiers ํ—ฌํผ๋กœ ๋ณ€๊ฒฝํ•˜์—ฌ ๋™์  import(...) ํ˜•ํƒœ๋„ ํƒ์ง€ํ•˜๋„๋ก ํ™•์žฅํ•œ๋‹ค.

์‹œํ€€์Šค ๋‹ค์ด์–ด๊ทธ๋žจ

sequenceDiagram
  participant Developer as ๊ฐœ๋ฐœ์ž / CI
  participant CLI as croco CLI
  participant Engine as `@croco/architecture-policy`
  participant Manifest as croco.arch.json
  participant SourceFiles as ์†Œ์Šค ํŒŒ์ผ

  Developer->>CLI: croco architecture-policy check --manifest croco.arch.json
  CLI->>Manifest: readArchitecturePolicyManifest(path)
  Manifest-->>CLI: ArchitecturePolicyManifest
  CLI->>Engine: checkArchitecturePolicy(options)
  Engine->>SourceFiles: walkFiles + collectSourceImports
  SourceFiles-->>Engine: ImportRecord[]
  Engine->>Engine: forbiddenImports ๊ทœ์น™ ์‹คํ–‰
  Engine->>Engine: allowedGroupImports ๊ทœ์น™ ์‹คํ–‰
  Engine->>Engine: publicEntrypoints ๊ทœ์น™ ์‹คํ–‰
  Engine-->>CLI: ArchitecturePolicyReport(pass/fail, diagnostics[])
  alt ํ†ต๊ณผ
    CLI->>Developer: "passed N imports across M packages" (exit 0)
  else ์‹คํŒจ
    CLI->>Developer: formatArchitecturePolicyDiagnostic ร— N + "N errors" (exit 1)
  end
Loading

์˜ˆ์ƒ ๊ฒ€ํ†  ์‹œ๊ฐ„

๐ŸŽฏ 4 (๋ณต์žก) | โฑ๏ธ ~60๋ถ„

๊ด€๋ จ ์ด์Šˆ

๊ด€๋ จ PR

  • croco-dev/framework#1041: ๋‘ PR ๋ชจ๋‘ packages/cli/src/commands/root.ts์˜ createCrocoCommand() subCommands ๋ฐฐ์—ด์„ ์—…๋ฐ์ดํŠธํ•˜๋Š”๋ฐ, ํ•˜๋‚˜๋Š” architecture-policy ๋ช…๋ น, ๋‹ค๋ฅธ ํ•˜๋‚˜๋Š” di ๋ช…๋ น์„ ์ถ”๊ฐ€ํ•œ๋‹ค.
๐Ÿšฅ Pre-merge checks | โœ… 4 | โŒ 1

โŒ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage โš ๏ธ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
โœ… Passed checks (4 passed)
Check name Status Explanation
Description Check โœ… Passed Check skipped - CodeRabbitโ€™s high-level summary is enabled.
Title check โœ… Passed The pull request title 'fix: enforce static architecture policy contracts' clearly describes the main change: introducing and enforcing static architecture policy contracts across the repository.
Linked Issues check โœ… Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check โœ… Passed Check skipped because no linked issues were found for this pull request.

โœ๏ธ Tip: You can configure your own custom pre-merge checks in the settings.

โœจ Finishing Touches
๐Ÿงช Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/931-architecture-policy

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

โค๏ธ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 5

๐Ÿค– Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/architecture-policy/src/index.ts`:
- Around line 151-158: The error handling in the manifest parser is throwing
generic Error instances instead of Problem subclasses, which violates the
repository's exception contract. Replace the two generic Error throws (one in
the isRecord validation check and one in the schemaVersion validation check)
with appropriate Problem subclasses that implement the RFC 7807 Problem format.
Each Problem subclass should include proper code and category properties to
enable consistent error handling upstream. Define or use existing Problem
subclasses that represent these specific validation failures.
- Around line 824-833: The matchesTargetMatcher function has two issues: first,
on line 828, matcher.paths is incorrectly compared against context.sourcePath
when it should be compared against context.targetPath since this function is
evaluating target matchers; second, on line 832, the function uses
checks.some(Boolean) which applies OR logic (returns true if any condition
matches), but it should use checks.every(Boolean) to apply AND logic so that all
present conditions in the matcher must be true for the overall match to succeed.
Fix both the wrong context property and the logic operator to ensure target
matchers evaluate correctly without over-matching.

In `@packages/architecture-policy/src/tests/ArchitecturePolicy.spec.ts`:
- Around line 278-285: The test for parseArchitecturePolicyManifest currently
only validates the error message string, which allows any Error type to pass the
test. Strengthen this test by replacing the simple message validation with a
check that validates the exception is a Problem subclass with the correct code
and category properties. Modify the expect().toThrow() call to validate not just
the error message but also confirm the thrown error is an instance of the
appropriate Problem class and verify its code and category property values match
the expected exception contract.

In `@packages/cli/src/commands/architecturePolicy.ts`:
- Around line 117-118: The issue is that getFlagValue for --root does not
properly consume its value argument, causing that value to be incorrectly picked
up as a positional argument by getFirstPosition in the manifest fallback on line
117. The --root value should not be treated as a positional argument. Ensure
that getFlagValue properly consumes both the flag and its associated value so
that getFirstPosition only returns actual positional arguments that were not
consumed by flag parsing. This will prevent `--root repo` from incorrectly
assigning repo to the manifest variable.

In `@scripts/architecture-policy-check.mts`:
- Around line 23-27: The argument validation for the --manifest flag (and
similarly for other flags around lines 33-37) only checks if a value exists, but
doesn't verify that the value isn't itself another flag starting with '--'. When
parsing the value from args[index + 1], add a check to ensure the value doesn't
start with '--' in addition to the existing null/undefined check, so that
invalid inputs like '--manifest --json' are properly rejected with a usage error
instead of silently accepting the flag as a path value.
๐Ÿช„ Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

โ„น๏ธ Review info
โš™๏ธ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: a57743f8-7fe9-4522-9fb2-97c14a1c2584

๐Ÿ“ฅ Commits

Reviewing files that changed from the base of the PR and between 9c1bc2e and 8f287fa.

โ›” Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
๐Ÿ“’ Files selected for processing (27)
  • .changeset/static-architecture-policy.md
  • README.md
  • croco.arch.json
  • docs/architecture-policy.md
  • docs/package-catalog.json
  • docs/package-docs-baseline.json
  • docs/package-docs-report.md
  • package.json
  • packages/architecture-policy/README.md
  • packages/architecture-policy/package.json
  • packages/architecture-policy/src/index.ts
  • packages/architecture-policy/src/tests/ArchitecturePolicy.spec.ts
  • packages/architecture-policy/tsconfig.json
  • packages/cli/package.json
  • packages/cli/src/commands/architecturePolicy.ts
  • packages/cli/src/commands/root.ts
  • packages/cli/src/index.ts
  • packages/cli/src/tests/architecturePolicyCheck.spec.ts
  • packages/cli/vitest.config.ts
  • packages/create-croco-app/src/generator.ts
  • packages/create-croco-app/src/tests/e2e-generation.spec.ts
  • packages/create-croco-app/src/tests/templates-build.spec.ts
  • packages/create-croco-app/templates/saas/package.json.hbs
  • public-api-surface.snapshot.json
  • scripts/architecture-policy-check.mts
  • scripts/create-croco-app-generated-smoke.mts
  • scripts/package-quality-report.mts

Comment thread packages/architecture-policy/src/index.ts Outdated
Comment thread packages/architecture-policy/src/index.ts
Comment thread packages/architecture-policy/src/tests/ArchitecturePolicy.spec.ts Outdated
Comment thread packages/cli/src/commands/architecturePolicy.ts Outdated
Comment thread scripts/architecture-policy-check.mts Outdated
@kang-heewon
kang-heewon force-pushed the fix/931-architecture-policy branch from 8f287fa to bf6a1bc Compare June 21, 2026 06:07
@github-actions

github-actions Bot commented Jun 21, 2026

Copy link
Copy Markdown

๐Ÿ“Š Benchmark Results

โŒ Some benchmarks failed

Gate failures

  • CrocoApp constructor: p75 7.0ฮผs exceeds baseline 3.4ฮผs by more than 20%
  • CrocoApp lambdaHandler (10 controllers): p75 197.9ฮผs exceeds baseline 33.3ฮผs by more than 20%
  • Lambda cold-start simulation: p75 331.2ฮผs exceeds baseline 70.2ฮผs by more than 20%
  • Lambda cold-start with headers: p75 308.8ฮผs exceeds baseline 66.7ฮผs by more than 20%
  • Lambda cold-start with binary body: p75 265.9ฮผs exceeds baseline 63.2ฮผs by more than 20%
  • Lambda cold-start with query params: p75 240.2ฮผs exceeds baseline 63.9ฮผs by more than 20%
  • Lambda cold-start with authorizer context: p75 243.0ฮผs exceeds baseline 59.8ฮผs by more than 20%
  • Lambda cold-start realistic scenario: p75 239.5ฮผs exceeds baseline 60.2ฮผs by more than 20%
  • EventBusConfig.start (10 handlers): p75 1.4ฮผs exceeds baseline 0.9ฮผs by more than 20%
  • EventPublisher.publishNow single event: p75 1.7ฮผs exceeds baseline 1.1ฮผs by more than 20%
  • DefaultHandlerResolver.resolve ร— 10: p75 0.1ฮผs exceeds baseline 0.0ฮผs by more than 20%
  • Container.get singleton (cold): p75 72.7ฮผs exceeds baseline 0.6ฮผs by more than 20%
  • Container.register ร— 50 components: p75 2.9ms exceeds baseline 12.1ฮผs by more than 20%
  • Container.validate (50 components): p75 3.1ms exceeds baseline 29.7ฮผs by more than 20%
  • Container.get singleton (warm): p75 1.7ฮผs exceeds baseline 0.3ฮผs by more than 20%
  • lambdaPreset config creation: p75 1.5ฮผs exceeds baseline 1.0ฮผs by more than 20%
Benchmark p75 Threshold Baseline vs Baseline Status Notes
CrocoApp constructor 7.0ฮผs 30.0ms 3.4ฮผs +107.5% โŒ -
CrocoApp lambdaHandler (10 controllers) 197.9ฮผs 50.0ms 33.3ฮผs +494.5% โŒ -
Lambda cold-start simulation 331.2ฮผs 80.0ms 70.2ฮผs +372.0% โŒ -
Lambda cold-start with headers 308.8ฮผs 80.0ms 66.7ฮผs +362.6% โŒ -
Lambda cold-start with binary body 265.9ฮผs 80.0ms 63.2ฮผs +320.9% โŒ -
Lambda cold-start with query params 240.2ฮผs 80.0ms 63.9ฮผs +276.0% โŒ -
Lambda cold-start with authorizer context 243.0ฮผs 80.0ms 59.8ฮผs +306.4% โŒ -
Lambda cold-start realistic scenario 239.5ฮผs 80.0ms 60.2ฮผs +298.0% โŒ -
EventBusConfig.start (10 handlers) 1.4ฮผs 10.0ms 0.9ฮผs +63.7% โŒ -
EventPublisher.publishNow single event 1.7ฮผs 2.0ms 1.1ฮผs +54.5% โŒ -
DefaultHandlerResolver.resolve ร— 10 0.1ฮผs 5.0ms 0.0ฮผs +90.5% โŒ -
Container.get singleton (cold) 72.7ฮผs 5.0ms 0.6ฮผs +11537.8% โŒ -
Container.register ร— 50 components 2.9ms 10.0ms 12.1ฮผs +23959.2% โŒ -
Container.validate (50 components) 3.1ms 20.0ms 29.7ฮผs +10274.6% โŒ -
Container.get singleton (warm) 1.7ฮผs 500.0ฮผs 0.3ฮผs +466.1% โŒ -
TelemetryRuntime.init (lambda preset) 1.1ms 200.0ms 69.3ms -98.4% โœ… -
lambdaPreset config creation 1.5ฮผs 2.0ms 1.0ฮผs +47.2% โŒ -

Updated: 2026-06-21T12:42:01.166Z ยท Commit: b77fdd2

@kang-heewon
kang-heewon force-pushed the fix/931-architecture-policy branch 5 times, most recently from eaca863 to 6ca6757 Compare June 21, 2026 06:49
@kang-heewon
kang-heewon force-pushed the fix/931-architecture-policy branch from 6ca6757 to 0a1ebbd Compare June 21, 2026 10:00

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 9

๐Ÿค– Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@croco.arch.json`:
- Around line 107-122: The `to.packages` list in the
framework-provider-package-boundary rule (lines 107-122) is incomplete and does
not include all the integration implementation packages defined earlier in the
file (lines 56-73). Review the integrations section to identify all
implementation packages and add the missing ones to the `to.packages` array,
including packages like `@croco/*-posthog`, `@croco/events-tx`,
`@croco/metrics-billing`, and `@croco/telemetry-sdk-node` that are currently
missing. Ensure the forbidden packages list comprehensively covers all
integration implementation packages so the framework group cannot directly
import them.

In `@docs/package-docs-baseline.json`:
- Line 9: The entries in the allowedMissingApiDocs array are not sorted in
alphabetical order. The entry "architecture-policy" appears before
"analytics-posthog", but alphabetically "analytics" should come before
"architecture". Reorder the array entries so that they are in alphabetical
order, ensuring "analytics-posthog" appears before "architecture-policy" in the
allowedMissingApiDocs array.

In `@package.json`:
- Line 7: The pnpm filter selector in the architecture-policy:check script uses
`@croco/architecture-policy^...` which excludes the target package itself from
the build, causing import failures when scripts/architecture-policy-check.mts
tries to use `@croco/architecture-policy`. Change the filter from
`@croco/architecture-policy^...` to `@croco/architecture-policy...` to include
the package itself in the build process.

In `@packages/architecture-policy/src/index.ts`:
- Around line 175-177: The parseArchitecturePolicyManifest function and the
similar code at line 476-477 directly call JSON.parse without error handling,
which throws generic SyntaxError instances that violate the coding guideline
requiring only Problem subclasses to be thrown. Wrap the JSON.parse calls in
try-catch blocks at both locations (lines 176-177 and 476-477), catch any errors
thrown by JSON.parse, and convert them to an appropriate Problem subclass before
throwing, ensuring the error information includes relevant code and category
properties for consistent handling by upper layers.

In `@packages/architecture-policy/src/tests/ArchitecturePolicy.spec.ts`:
- Around line 519-527: The captureError function violates the coding guideline
by throwing a generic Error instance at the end of the function. Instead of
using throw new Error for the failure case when the function does not throw an
exception as expected, replace it with a Vitest assertion API call such as
fail() which provides a proper way to fail the test without throwing a generic
Error class. This maintains the same intent while adhering to the rule that only
Problem subclasses should be thrown.

In `@packages/cli/src/commands/architecturePolicy.ts`:
- Around line 199-200: The resolvePath function uses path.startsWith("/") to
detect absolute paths, which only works for POSIX-style paths. This causes
Windows absolute paths like C:\repo or C:/repo to be treated as relative paths
and incorrectly resolved against the cwd. Replace the path.startsWith("/") check
with the path.isAbsolute() method, which correctly identifies absolute paths
across all operating systems (both POSIX and Windows).

In `@packages/create-croco-app/src/generator.ts`:
- Around line 249-256: The ignore patterns in the generator.ts file are missing
the `__tests__` directory convention used in many projects. Add the pattern
`src/**/__tests__/**` to the ignore arrays in both locations (the block starting
at line 249 and the block starting at line 349) alongside the existing patterns
for `src/**/tests/**`, `*.spec.ts`, and `*.test.ts`. This will ensure that
projects using the `__tests__` naming convention for test directories won't
trigger false positives in architecture-policy checks by treating test code as
production imports.

In `@packages/create-croco-app/src/tests/e2e-generation.spec.ts`:
- Line 784: The assertion in the e2e-generation.spec.ts file is checking for an
exact version string "^0.0.4" for the "`@croco/cli`" dev dependency, which will
cause test failures whenever the package version is updated. Instead of using
toBe() with a hardcoded version, change the assertion to validate that the
"`@croco/cli`" dependency exists and matches a semver pattern using a regular
expression like /^\^[0-9]+\.[0-9]+\.[0-9]+$/, or simply verify the dependency
key exists in the devDependencies object without validating the specific version
number.

In `@packages/create-croco-app/src/tests/templates-build.spec.ts`:
- Around line 426-427: The regex pattern for the `demo:smoke` task validation at
line 426-427 is incomplete and does not verify the final `ops:smoke` stage in
the chain. Extend the stringMatching regex pattern to include `ops:smoke` at the
end after `api-server demo:smoke` to ensure the complete task chain is validated
and prevent the test from passing when the `ops:smoke` step is missing from the
template.
๐Ÿช„ Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

โ„น๏ธ Review info
โš™๏ธ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: d4541166-3065-460f-9264-127af50ad9c7

๐Ÿ“ฅ Commits

Reviewing files that changed from the base of the PR and between 8f287fa and 0a1ebbd.

๐Ÿ“’ Files selected for processing (24)
  • .changeset/static-architecture-policy.md
  • README.md
  • croco.arch.json
  • docs/architecture-policy.md
  • docs/package-catalog.json
  • docs/package-docs-baseline.json
  • docs/package-docs-report.md
  • docs/problem-code-registry.json
  • package.json
  • packages/architecture-policy/README.md
  • packages/architecture-policy/package.json
  • packages/architecture-policy/src/index.ts
  • packages/architecture-policy/src/tests/ArchitecturePolicy.spec.ts
  • packages/architecture-policy/tsconfig.json
  • packages/cli/package.json
  • packages/cli/src/commands/architecturePolicy.ts
  • packages/cli/src/commands/root.ts
  • packages/cli/src/index.ts
  • packages/cli/src/tests/architecturePolicyCheck.spec.ts
  • packages/cli/vitest.config.ts
  • packages/create-croco-app/src/generator.ts
  • packages/create-croco-app/src/tests/e2e-generation.spec.ts
  • packages/create-croco-app/src/tests/templates-build.spec.ts
  • packages/create-croco-app/templates/saas/package.json.hbs
๐Ÿ’ค Files with no reviewable changes (1)
  • docs/problem-code-registry.json

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.

Actionable comments posted: 9

๐Ÿค– Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@croco.arch.json`:
- Around line 107-122: The `to.packages` list in the
framework-provider-package-boundary rule (lines 107-122) is incomplete and does
not include all the integration implementation packages defined earlier in the
file (lines 56-73). Review the integrations section to identify all
implementation packages and add the missing ones to the `to.packages` array,
including packages like `@croco/*-posthog`, `@croco/events-tx`,
`@croco/metrics-billing`, and `@croco/telemetry-sdk-node` that are currently
missing. Ensure the forbidden packages list comprehensively covers all
integration implementation packages so the framework group cannot directly
import them.

In `@docs/package-docs-baseline.json`:
- Line 9: The entries in the allowedMissingApiDocs array are not sorted in
alphabetical order. The entry "architecture-policy" appears before
"analytics-posthog", but alphabetically "analytics" should come before
"architecture". Reorder the array entries so that they are in alphabetical
order, ensuring "analytics-posthog" appears before "architecture-policy" in the
allowedMissingApiDocs array.

In `@package.json`:
- Line 7: The pnpm filter selector in the architecture-policy:check script uses
`@croco/architecture-policy^...` which excludes the target package itself from
the build, causing import failures when scripts/architecture-policy-check.mts
tries to use `@croco/architecture-policy`. Change the filter from
`@croco/architecture-policy^...` to `@croco/architecture-policy...` to include
the package itself in the build process.

In `@packages/architecture-policy/src/index.ts`:
- Around line 175-177: The parseArchitecturePolicyManifest function and the
similar code at line 476-477 directly call JSON.parse without error handling,
which throws generic SyntaxError instances that violate the coding guideline
requiring only Problem subclasses to be thrown. Wrap the JSON.parse calls in
try-catch blocks at both locations (lines 176-177 and 476-477), catch any errors
thrown by JSON.parse, and convert them to an appropriate Problem subclass before
throwing, ensuring the error information includes relevant code and category
properties for consistent handling by upper layers.

In `@packages/architecture-policy/src/tests/ArchitecturePolicy.spec.ts`:
- Around line 519-527: The captureError function violates the coding guideline
by throwing a generic Error instance at the end of the function. Instead of
using throw new Error for the failure case when the function does not throw an
exception as expected, replace it with a Vitest assertion API call such as
fail() which provides a proper way to fail the test without throwing a generic
Error class. This maintains the same intent while adhering to the rule that only
Problem subclasses should be thrown.

In `@packages/cli/src/commands/architecturePolicy.ts`:
- Around line 199-200: The resolvePath function uses path.startsWith("/") to
detect absolute paths, which only works for POSIX-style paths. This causes
Windows absolute paths like C:\repo or C:/repo to be treated as relative paths
and incorrectly resolved against the cwd. Replace the path.startsWith("/") check
with the path.isAbsolute() method, which correctly identifies absolute paths
across all operating systems (both POSIX and Windows).

In `@packages/create-croco-app/src/generator.ts`:
- Around line 249-256: The ignore patterns in the generator.ts file are missing
the `__tests__` directory convention used in many projects. Add the pattern
`src/**/__tests__/**` to the ignore arrays in both locations (the block starting
at line 249 and the block starting at line 349) alongside the existing patterns
for `src/**/tests/**`, `*.spec.ts`, and `*.test.ts`. This will ensure that
projects using the `__tests__` naming convention for test directories won't
trigger false positives in architecture-policy checks by treating test code as
production imports.

In `@packages/create-croco-app/src/tests/e2e-generation.spec.ts`:
- Line 784: The assertion in the e2e-generation.spec.ts file is checking for an
exact version string "^0.0.4" for the "`@croco/cli`" dev dependency, which will
cause test failures whenever the package version is updated. Instead of using
toBe() with a hardcoded version, change the assertion to validate that the
"`@croco/cli`" dependency exists and matches a semver pattern using a regular
expression like /^\^[0-9]+\.[0-9]+\.[0-9]+$/, or simply verify the dependency
key exists in the devDependencies object without validating the specific version
number.

In `@packages/create-croco-app/src/tests/templates-build.spec.ts`:
- Around line 426-427: The regex pattern for the `demo:smoke` task validation at
line 426-427 is incomplete and does not verify the final `ops:smoke` stage in
the chain. Extend the stringMatching regex pattern to include `ops:smoke` at the
end after `api-server demo:smoke` to ensure the complete task chain is validated
and prevent the test from passing when the `ops:smoke` step is missing from the
template.
๐Ÿช„ Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

โ„น๏ธ Review info
โš™๏ธ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: d4541166-3065-460f-9264-127af50ad9c7

๐Ÿ“ฅ Commits

Reviewing files that changed from the base of the PR and between 8f287fa and 0a1ebbd.

๐Ÿ“’ Files selected for processing (24)
  • .changeset/static-architecture-policy.md
  • README.md
  • croco.arch.json
  • docs/architecture-policy.md
  • docs/package-catalog.json
  • docs/package-docs-baseline.json
  • docs/package-docs-report.md
  • docs/problem-code-registry.json
  • package.json
  • packages/architecture-policy/README.md
  • packages/architecture-policy/package.json
  • packages/architecture-policy/src/index.ts
  • packages/architecture-policy/src/tests/ArchitecturePolicy.spec.ts
  • packages/architecture-policy/tsconfig.json
  • packages/cli/package.json
  • packages/cli/src/commands/architecturePolicy.ts
  • packages/cli/src/commands/root.ts
  • packages/cli/src/index.ts
  • packages/cli/src/tests/architecturePolicyCheck.spec.ts
  • packages/cli/vitest.config.ts
  • packages/create-croco-app/src/generator.ts
  • packages/create-croco-app/src/tests/e2e-generation.spec.ts
  • packages/create-croco-app/src/tests/templates-build.spec.ts
  • packages/create-croco-app/templates/saas/package.json.hbs
๐Ÿ’ค Files with no reviewable changes (1)
  • docs/problem-code-registry.json
๐Ÿ›‘ Comments failed to post (9)
croco.arch.json (1)

107-122: โš ๏ธ Potential issue | ๐ŸŸ  Major | โšก Quick win

framework-provider-package-boundary ๊ธˆ์ง€ ๋Œ€์ƒ์ด ๋ถˆ์™„์ „ํ•ฉ๋‹ˆ๋‹ค.

Line 107-122์˜ to.packages๊ฐ€ ๊ฐ™์€ ํŒŒ์ผ Line 56-73์˜ integrations ๊ตฌํ˜„ ํŒจํ‚ค์ง€์™€ ๋ถˆ์ผ์น˜ํ•ฉ๋‹ˆ๋‹ค. ํ˜„์žฌ ์ƒํƒœ๋ฉด framework ๊ทธ๋ฃน์ด ์ผ๋ถ€ ๊ตฌํ˜„ ํŒจํ‚ค์ง€(@croco/*-posthog, @croco/events-tx, @croco/metrics-billing, @croco/telemetry-sdk-node ๋“ฑ)๋ฅผ ์ง์ ‘ importํ•ด๋„ ์ฐจ๋‹จ๋˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค.

์ˆ˜์ • ์˜ˆ์‹œ
         "to": {
           "packages": [
+            "`@croco/`*-posthog",
             "`@croco/`*-drizzle",
             "`@croco/`*-qstash",
             "`@croco/`*-upstash",
             "`@croco/auth-better-auth`",
             "`@croco/auth-clerk`",
             "`@croco/billing-polar`",
+            "`@croco/events-tx`",
             "`@croco/llm-openai`",
+            "`@croco/metrics-billing`",
             "`@croco/notifications-resend`",
             "`@croco/search-meilisearch`",
             "`@croco/storage-cloudflare`",
             "`@croco/storage-cloudinary`",
             "`@croco/storage-r2`",
+            "`@croco/telemetry-sdk-node`",
             "`@croco/transports-`*",
             "`@croco/tx-drizzle`"
           ]
         },
๐Ÿ“ Committable suggestion

โ€ผ๏ธ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

          "packages": [
            "`@croco/`*-posthog",
            "`@croco/`*-drizzle",
            "`@croco/`*-qstash",
            "`@croco/`*-upstash",
            "`@croco/auth-better-auth`",
            "`@croco/auth-clerk`",
            "`@croco/billing-polar`",
            "`@croco/events-tx`",
            "`@croco/llm-openai`",
            "`@croco/metrics-billing`",
            "`@croco/notifications-resend`",
            "`@croco/search-meilisearch`",
            "`@croco/storage-cloudflare`",
            "`@croco/storage-cloudinary`",
            "`@croco/storage-r2`",
            "`@croco/telemetry-sdk-node`",
            "`@croco/transports-`*",
            "`@croco/tx-drizzle`"
          ]
๐Ÿค– Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@croco.arch.json` around lines 107 - 122, The `to.packages` list in the
framework-provider-package-boundary rule (lines 107-122) is incomplete and does
not include all the integration implementation packages defined earlier in the
file (lines 56-73). Review the integrations section to identify all
implementation packages and add the missing ones to the `to.packages` array,
including packages like `@croco/*-posthog`, `@croco/events-tx`,
`@croco/metrics-billing`, and `@croco/telemetry-sdk-node` that are currently
missing. Ensure the forbidden packages list comprehensively covers all
integration implementation packages so the framework group cannot directly
import them.
docs/package-docs-baseline.json (1)

9-9: โš ๏ธ Potential issue | ๐ŸŸก Minor | โšก Quick win

allowedMissingApiDocs ๋ฐฐ์—ด์˜ ์•ŒํŒŒ๋ฒณ ์ˆœ์„œ๊ฐ€ ์ž˜๋ชป๋˜์—ˆ์Šต๋‹ˆ๋‹ค.

Line 9์˜ "architecture-policy"๋Š” line 10์˜ "analytics-posthog"๋ณด๋‹ค ๋’ค์— ์™€์•ผ ํ•ฉ๋‹ˆ๋‹ค. "analytics"๊ฐ€ "architecture"๋ณด๋‹ค ์•ŒํŒŒ๋ฒณ ์ˆœ์„œ์ƒ ์•ž์ž…๋‹ˆ๋‹ค.

- "admin-react",
- "architecture-policy",
- "analytics-posthog",
+ "admin-react",
+ "analytics-posthog",
+ "architecture-policy",
๐Ÿ“ Committable suggestion

โ€ผ๏ธ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

    "admin-react",
    "analytics-posthog",
    "architecture-policy",
๐Ÿค– Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/package-docs-baseline.json` at line 9, The entries in the
allowedMissingApiDocs array are not sorted in alphabetical order. The entry
"architecture-policy" appears before "analytics-posthog", but alphabetically
"analytics" should come before "architecture". Reorder the array entries so that
they are in alphabetical order, ensuring "analytics-posthog" appears before
"architecture-policy" in the allowedMissingApiDocs array.
package.json (1)

7-7: โš ๏ธ Potential issue | ๐ŸŸ  Major

๐Ÿงฉ Analysis chain

๐ŸŒ Web query:

pnpm filter ๋ฌธ๋ฒ•์—์„œ "<package>^..."๋Š” ์–ด๋–ค ํŒจํ‚ค์ง€ ์ง‘ํ•ฉ์„ ์„ ํƒํ•˜๋‚˜์š”? ๋Œ€์ƒ ํŒจํ‚ค์ง€ ์ž์‹ ๋„ ํฌํ•จ๋˜๋‚˜์š”?

๐Ÿ’ก Result:

pnpm์˜ filter ๋ฌธ๋ฒ•์—์„œ ^...๋Š” ๋Œ€์ƒ ํŒจํ‚ค์ง€์˜ ์˜์กด์„ฑ(์ง์ ‘ ๋ฐ ๊ฐ„์ ‘ ์˜์กด์„ฑ ๋ชจ๋‘ ํฌํ•จ)๋งŒ์„ ์„ ํƒํ•ฉ๋‹ˆ๋‹ค [1][2][3]. ์งˆ๋ฌธํ•˜์‹  ๋‚ด์šฉ์— ๋Œ€ํ•œ ํ•ต์‹ฌ ๋‹ต๋ณ€์€ ๋‹ค์Œ๊ณผ ๊ฐ™์Šต๋‹ˆ๋‹ค: ๋Œ€์ƒ ํŒจํ‚ค์ง€ ์ž์‹ ์€ ํฌํ•จ๋˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค [1][3][4]. ์ด ๋ฌธ๋ฒ•์€ ํŠน์ • ํŒจํ‚ค์ง€์˜ ์˜์กด์„ฑ๋“ค์„ ๋Œ€์ƒ์œผ๋กœ ์ž‘์—…(์˜ˆ: ํ…Œ์ŠคํŠธ ์‹คํ–‰, ๋นŒ๋“œ ๋“ฑ)์„ ์ˆ˜ํ–‰ํ•˜๊ณ ์ž ํ•  ๋•Œ, ํ•ด๋‹น ํŒจํ‚ค์ง€ ์ž์ฒด๋Š” ์ œ์™ธํ•˜๊ณ  ์‹ถ์„ ๊ฒฝ์šฐ์— ์‚ฌ์šฉ๋ฉ๋‹ˆ๋‹ค [1][2][4]. ์ฐธ๊ณ ๋กœ, ๋Œ€์ƒ ํŒจํ‚ค์ง€๊นŒ์ง€ ํฌํ•จํ•˜์—ฌ ์˜์กด์„ฑ์„ ์„ ํƒํ•˜๋ ค๋ฉด ... ๋ฌธ๋ฒ•์„ ์‚ฌ์šฉํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค [1][5][3].

Citations:


pnpm --filter ํ•„ํ„ฐ ์„ ํƒ์ž ์ˆ˜์ • ํ•„์š”

@croco/architecture-policy^... ํ•„ํ„ฐ๋Š” ๋Œ€์ƒ ํŒจํ‚ค์ง€์˜ ์˜์กด์„ฑ๋งŒ ์„ ํƒํ•˜๊ณ  @croco/architecture-policy ์ž์ฒด๋Š” ์ œ์™ธํ•ฉ๋‹ˆ๋‹ค. ๋”ฐ๋ผ์„œ scripts/architecture-policy-check.mts์—์„œ @croco/architecture-policy๋ฅผ importํ•  ๋•Œ ๋นŒ๋“œ ์‚ฐ์ถœ๋ฌผ์ด ์—†์–ด ์‹คํŒจํ•ฉ๋‹ˆ๋‹ค.

@croco/architecture-policy^... ๋Œ€์‹  @croco/architecture-policy...๋กœ ์ˆ˜์ •ํ•˜์—ฌ ๋Œ€์ƒ ํŒจํ‚ค์ง€๋„ ํ•จ๊ป˜ ๋นŒ๋“œํ•˜์„ธ์š”.

๐Ÿค– Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` at line 7, The pnpm filter selector in the
architecture-policy:check script uses `@croco/architecture-policy^...` which
excludes the target package itself from the build, causing import failures when
scripts/architecture-policy-check.mts tries to use `@croco/architecture-policy`.
Change the filter from `@croco/architecture-policy^...` to
`@croco/architecture-policy...` to include the package itself in the build
process.
packages/architecture-policy/src/index.ts (1)

175-177: โš ๏ธ Potential issue | ๐ŸŸ  Major | โšก Quick win

JSON ํŒŒ์‹ฑ ์‹คํŒจ๋ฅผ Problem ํ•˜์œ„ ํƒ€์ž…์œผ๋กœ ์ •๊ทœํ™”ํ•˜์„ธ์š”.

Line 176-177, Line 476-477์—์„œ JSON.parse์˜ SyntaxError๊ฐ€ ๊ทธ๋Œ€๋กœ ์ „ํŒŒ๋˜์–ด ์˜ˆ์™ธ ๊ณ„์•ฝ์ด ๊นจ์ง‘๋‹ˆ๋‹ค. ์ž˜๋ชป๋œ JSON ์ž…๋ ฅ ์‹œ ์ƒ์œ„ ๋ ˆ์ด์–ด๊ฐ€ code/category ๊ธฐ๋ฐ˜์œผ๋กœ ์ผ๊ด€ ์ฒ˜๋ฆฌํ•˜์ง€ ๋ชปํ•ฉ๋‹ˆ๋‹ค.

์ˆ˜์ • ์˜ˆ์‹œ
+export class ArchitecturePolicyManifestJsonParseProblem extends Problem {
+  constructor() {
+    super(
+      "architecture-policy/manifest-json-parse",
+      ProblemCategory.ValidationError,
+      "Architecture policy manifest must contain valid JSON.",
+    );
+  }
+}
+
+export class ArchitecturePolicyPackageJsonParseProblem extends Problem {
+  constructor(packageJsonPath: string) {
+    super(
+      "architecture-policy/package-json-parse",
+      ProblemCategory.ValidationError,
+      `Invalid package.json: ${packageJsonPath}.`,
+    );
+  }
+}
+
 export function parseArchitecturePolicyManifest(content: string): ArchitecturePolicyManifest {
-  const parsed = JSON.parse(content) as unknown;
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(content) as unknown;
+  } catch {
+    throw new ArchitecturePolicyManifestJsonParseProblem();
+  }
@@
 function readJsonFile(path: string): unknown {
-  return JSON.parse(readFileSync(path, "utf-8")) as unknown;
+  try {
+    return JSON.parse(readFileSync(path, "utf-8")) as unknown;
+  } catch {
+    throw new ArchitecturePolicyPackageJsonParseProblem(path);
+  }
 }

As per coding guidelines, Throw only Problem subclasses, never generic Error instances ๊ทœ์น™์„ ๋”ฐ๋ผ์•ผ ํ•ฉ๋‹ˆ๋‹ค.

Also applies to: 476-477

๐Ÿค– Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/architecture-policy/src/index.ts` around lines 175 - 177, The
parseArchitecturePolicyManifest function and the similar code at line 476-477
directly call JSON.parse without error handling, which throws generic
SyntaxError instances that violate the coding guideline requiring only Problem
subclasses to be thrown. Wrap the JSON.parse calls in try-catch blocks at both
locations (lines 176-177 and 476-477), catch any errors thrown by JSON.parse,
and convert them to an appropriate Problem subclass before throwing, ensuring
the error information includes relevant code and category properties for
consistent handling by upper layers.

Source: Coding guidelines

packages/architecture-policy/src/tests/ArchitecturePolicy.spec.ts (1)

519-527: ๐Ÿ› ๏ธ Refactor suggestion | ๐ŸŸ  Major | โšก Quick win

ํ…Œ์ŠคํŠธ ํ—ฌํผ์˜ ์‹คํŒจ ๊ฒฝ๋กœ์—์„œ generic Error ์‚ฌ์šฉ์„ ์ œ๊ฑฐํ•˜์„ธ์š”.

Line 526์˜ new Error(...) ๋Œ€์‹  Vitest assertion API๋ฅผ ์‚ฌ์šฉํ•˜๋ฉด ์˜ˆ์™ธ ๊ณ„์•ฝ ์œ„๋ฐ˜ ์—†์ด ๋™์ผํ•œ ์˜๋„๋ฅผ ์œ ์ง€ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

์ˆ˜์ • ์˜ˆ์‹œ
 function captureError(fn: () => void): unknown {
   try {
     fn();
   } catch (error) {
     return error;
   }
 
-  throw new Error("Expected function to throw.");
+  expect.unreachable("Expected function to throw.");
 }

As per coding guidelines, Throw only Problem subclasses, never generic Error instances ๊ทœ์น™์„ ์ค€์ˆ˜ํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค.

๐Ÿ“ Committable suggestion

โ€ผ๏ธ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

function captureError(fn: () => void): unknown {
  try {
    fn();
  } catch (error) {
    return error;
  }

  expect.unreachable("Expected function to throw.");
}
๐Ÿค– Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/architecture-policy/src/tests/ArchitecturePolicy.spec.ts` around
lines 519 - 527, The captureError function violates the coding guideline by
throwing a generic Error instance at the end of the function. Instead of using
throw new Error for the failure case when the function does not throw an
exception as expected, replace it with a Vitest assertion API call such as
fail() which provides a proper way to fail the test without throwing a generic
Error class. This maintains the same intent while adhering to the rule that only
Problem subclasses should be thrown.

Source: Coding guidelines

packages/cli/src/commands/architecturePolicy.ts (1)

199-200: โš ๏ธ Potential issue | ๐ŸŸ  Major

๐Ÿงฉ Analysis chain

๐Ÿ Script executed:

# Check if the file exists and examine the relevant lines
head -n 220 packages/cli/src/commands/architecturePolicy.ts | tail -n 30

Repository: croco-dev/framework

Length of output: 734


๐Ÿ Script executed:

# Check the imports at the top of the file
head -n 30 packages/cli/src/commands/architecturePolicy.ts

Repository: croco-dev/framework

Length of output: 1048


๐Ÿ Script executed:

# Get the entire function context around lines 199-200
sed -n '190,210p' packages/cli/src/commands/architecturePolicy.ts

Repository: croco-dev/framework

Length of output: 304


๐Ÿ Script executed:

# Verify that isAbsolute is available from node:path module
node -e "const path = require('path'); console.log(typeof path.isAbsolute);"

Repository: croco-dev/framework

Length of output: 72


๐ŸŒ Web query:

node:path isAbsolute cross-platform Windows absolute paths

๐Ÿ’ก Result:

In Node.js, the path.isAbsolute(path) method determines if a path is absolute based on the operating system of the current process [1][2]. When running on Windows, it uses the Windows-specific rules for determining absolute paths [1][3]. Key behaviors on Windows include: 1. Rooted Paths: Paths that start with a drive letter and a colon followed by a separator (e.g., C:\foo or C:/foo) are considered absolute [1][4]. 2. UNC Paths: Paths starting with a double separator (e.g., \\server\share or //server/share) are considered absolute [1][4]. 3. Drive-Relative Paths: A point of common confusion is that paths starting with a single separator (e.g., \Windows or /Windows) are also considered absolute by Node.js [5][4]. While these are technically "drive-relative" (relative to the current drive's root), Node.js follows the Windows API convention which treats them as absolute because they contain a root component [5][6]. If you need to strictly verify whether a path is fully qualified (i.e., including both a drive letter/UNC root and a path), you cannot rely solely on path.isAbsolute [6]. Instead, you must manually check if the path starts with a drive letter (e.g., /^[a-zA-Z]:\/ or similar) or a UNC prefix [6]. The path.win32 object provides access to these Windows-specific path methods regardless of the host operating system, which is useful for cross-platform processing of Windows paths [2]. Note that path.isAbsolute is intended for checking the structure of a string and is not secure for mitigating path traversal vulnerabilities [1][2].

Citations:


Windows ํ™˜๊ฒฝ์—์„œ ์ ˆ๋Œ€ ๊ฒฝ๋กœ ํŒ๋ณ„์ด ์˜ค์ž‘๋™ํ•ฉ๋‹ˆ๋‹ค.

Line 199์˜ path.startsWith("/")๋Š” POSIX ๊ฒฝ๋กœ๋งŒ ์ ˆ๋Œ€ ๊ฒฝ๋กœ๋กœ ์ธ์‹ํ•ฉ๋‹ˆ๋‹ค. Windows์˜ C:\repo ๋˜๋Š” C:/repo ๊ฐ™์€ ๊ฒฝ๋กœ๋Š” ์ƒ๋Œ€ ๊ฒฝ๋กœ๋กœ ์ฒ˜๋ฆฌ๋˜์–ด cwd์™€ ์ž˜๋ชป ๊ฒฐํ•ฉ๋ฉ๋‹ˆ๋‹ค. path.isAbsolute()๋ฅผ ์‚ฌ์šฉํ•˜๋ฉด OS์— ๋งž๊ฒŒ ์ ˆ๋Œ€ ๊ฒฝ๋กœ๋ฅผ ์˜ฌ๋ฐ”๋ฅด๊ฒŒ ํŒ๋ณ„ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

๐Ÿ”ง ์ˆ˜์ • ์ œ์•ˆ
-import { resolve } from "node:path";
+import { isAbsolute, resolve } from "node:path";
@@
 function resolvePath(path: string, cwd: string): string {
-  return path.startsWith("/") ? path : resolve(cwd, path);
+  return isAbsolute(path) ? path : resolve(cwd, path);
 }
๐Ÿ“ Committable suggestion

โ€ผ๏ธ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

import { isAbsolute, resolve } from "node:path";

function resolvePath(path: string, cwd: string): string {
  return isAbsolute(path) ? path : resolve(cwd, path);
}
๐Ÿค– Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/cli/src/commands/architecturePolicy.ts` around lines 199 - 200, The
resolvePath function uses path.startsWith("/") to detect absolute paths, which
only works for POSIX-style paths. This causes Windows absolute paths like
C:\repo or C:/repo to be treated as relative paths and incorrectly resolved
against the cwd. Replace the path.startsWith("/") check with the
path.isAbsolute() method, which correctly identifies absolute paths across all
operating systems (both POSIX and Windows).
packages/create-croco-app/src/generator.ts (1)

249-256: โš ๏ธ Potential issue | ๐ŸŸก Minor | โšก Quick win

ํ…Œ์ŠคํŠธ ์ œ์™ธ glob์— __tests__๊ฐ€ ๋น ์ ธ ์žˆ์–ด ์ •์ฑ… ์˜คํƒ ๊ฐ€๋Šฅ์„ฑ์ด ์žˆ์Šต๋‹ˆ๋‹ค.

Line 249-256๊ณผ Line 349-356์—์„œ src/**/tests/**, *.spec.ts, *.test.ts๋งŒ ์ œ์™ธํ•˜๊ณ  src/**/__tests__/**๋ฅผ ์ œ์™ธํ•˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค. ์ƒ์„ฑ ํ”„๋กœ์ ํŠธ๊ฐ€ __tests__ ๊ด€๋ก€๋ฅผ ์“ฐ๋ฉด architecture-policy๊ฐ€ ํ…Œ์ŠคํŠธ ์ฝ”๋“œ๋ฅผ production import๋กœ ๊ฒ€์‚ฌํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

์ˆ˜์ • ์˜ˆ์‹œ
     ignore: [
+      "apps/*/src/**/__tests__/**",
       "apps/*/src/**/tests/**",
       "apps/*/src/**/*.spec.ts",
       "apps/*/src/**/*.test.ts",
+      "libs/shared/*/src/**/__tests__/**",
       "libs/shared/*/src/**/tests/**",
       "libs/shared/*/src/**/*.spec.ts",
       "libs/shared/*/src/**/*.test.ts",
     ],
...
         ignoreImports: [
           {
             paths: [
+              "apps/*/src/**/__tests__/**",
               "apps/*/src/**/tests/**",
               "apps/*/src/**/*.spec.ts",
               "apps/*/src/**/*.test.ts",
+              "libs/shared/*/src/**/__tests__/**",
               "libs/shared/*/src/**/tests/**",
               "libs/shared/*/src/**/*.spec.ts",
               "libs/shared/*/src/**/*.test.ts",
             ],

Also applies to: 349-356

๐Ÿค– Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/create-croco-app/src/generator.ts` around lines 249 - 256, The
ignore patterns in the generator.ts file are missing the `__tests__` directory
convention used in many projects. Add the pattern `src/**/__tests__/**` to the
ignore arrays in both locations (the block starting at line 249 and the block
starting at line 349) alongside the existing patterns for `src/**/tests/**`,
`*.spec.ts`, and `*.test.ts`. This will ensure that projects using the
`__tests__` naming convention for test directories won't trigger false positives
in architecture-policy checks by treating test code as production imports.
packages/create-croco-app/src/tests/e2e-generation.spec.ts (1)

784-784: โš ๏ธ Potential issue | ๐ŸŸก Minor | โšก Quick win

ํŒจํ‚ค์ง€ ๋ฒ„์ „ ๊ณ ์ • assertion์ด E2E๋ฅผ ๋ถˆํ•„์š”ํ•˜๊ฒŒ ๊นจ๋œจ๋ฆด ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

Line 784์˜ toBe('^0.0.4')๋Š” ๋ฒ„์ „ ์—…๋ฐ์ดํŠธ๋งˆ๋‹ค ํ…Œ์ŠคํŠธ๋ฅผ ๊นจ๊ฒŒ ๋ฉ๋‹ˆ๋‹ค. ์ƒ์„ฑ ๊ฒฐ๊ณผ์˜ ์˜๋„๋Š” โ€œCLI ์˜์กด์„ฑ ์กด์žฌ/ํ˜•์‹โ€ ๊ฒ€์ฆ์ด๋ฏ€๋กœ semver ํŒจํ„ด ๋˜๋Š” ์กด์žฌ์„ฑ ๊ฒ€์ฆ์œผ๋กœ ์™„ํ™”ํ•˜๋Š” ํŽธ์ด ์•ˆ์ „ํ•ฉ๋‹ˆ๋‹ค.

๐Ÿค– Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/create-croco-app/src/tests/e2e-generation.spec.ts` at line 784, The
assertion in the e2e-generation.spec.ts file is checking for an exact version
string "^0.0.4" for the "`@croco/cli`" dev dependency, which will cause test
failures whenever the package version is updated. Instead of using toBe() with a
hardcoded version, change the assertion to validate that the "`@croco/cli`"
dependency exists and matches a semver pattern using a regular expression like
/^\^[0-9]+\.[0-9]+\.[0-9]+$/, or simply verify the dependency key exists in the
devDependencies object without validating the specific version number.
packages/create-croco-app/src/tests/templates-build.spec.ts (1)

426-427: โš ๏ธ Potential issue | ๐ŸŸก Minor | โšก Quick win

demo:smoke ์ •๊ทœ์‹์ด ๋งˆ์ง€๋ง‰ ops:smoke ๋‹จ๊ณ„๋ฅผ ๋ณด์žฅํ•˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค.

Line 426-427 ํŒจํ„ด์€ api-server demo:smoke๊นŒ์ง€๋งŒ ๊ฒ€์ฆํ•ด์„œ, ํ…œํ”Œ๋ฆฟ์—์„œ ops:smoke๊ฐ€ ๋น ์ ธ๋„ ํ†ต๊ณผํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ฒด์ธ ์™„๊ฒฐ์„ฑ์„ ๊ฒ€์ฆํ•˜๋„๋ก ํŒจํ„ด ๋์— ops:smoke๊นŒ์ง€ ํฌํ•จํ•ด ์ฃผ์„ธ์š”.

๐Ÿค– Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/create-croco-app/src/tests/templates-build.spec.ts` around lines 426
- 427, The regex pattern for the `demo:smoke` task validation at line 426-427 is
incomplete and does not verify the final `ops:smoke` stage in the chain. Extend
the stringMatching regex pattern to include `ops:smoke` at the end after
`api-server demo:smoke` to ensure the complete task chain is validated and
prevent the test from passing when the `ops:smoke` step is missing from the
template.

@kang-heewon
kang-heewon force-pushed the fix/931-architecture-policy branch 2 times, most recently from ddb49f1 to 8457dc3 Compare June 21, 2026 10:48
@kang-heewon

Copy link
Copy Markdown
Member Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jun 21, 2026

Copy link
Copy Markdown
โœ… Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 5

๐Ÿค– Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/architecture-policy/package.json`:
- Around line 14-25: The top-level `main` and `types` fields in package.json
point to `./src/index.ts`, but since only the `dist/` directory is published to
npm (via the `files` array), external consumers cannot resolve these paths.
Update the top-level `main` field to `./dist/index.js` and the `types` field to
`./dist/index.d.ts` to match the values in `publishConfig`, ensuring the
published package can be correctly resolved by consumers.

In `@packages/architecture-policy/src/index.ts`:
- Around line 763-765: The condition on line 763-765 in the index.ts file checks
only if context.targetGroup is null to determine if a dependency is external,
but targetGroup can be null for both actual external packages and internal
packages that lack group mapping. This causes unclassified internal packages to
bypass the allowedGroupImports validation when allowExternal is true. Fix this
by adding an additional check to distinguish between true external dependencies
and unmapped internal packages. You need to verify that the dependency is
actually external (not just unclassified internal) before allowing it through
the allowExternal exception, ensuring that internal packages without group
mapping still go through the allowedGroupImports validation gate.

In `@packages/architecture-policy/src/tests/ArchitecturePolicy.spec.ts`:
- Around line 485-517: Add a regression test case to verify the allowExternal
behavior in the generatedAppManifest function. The test should validate that
when allowExternal is set to true in the generated-app-layer-edges rule,
external packages from allowPackages are correctly permitted, while internal
packages that are not mapped to allowed groups are properly rejected. This
ensures the allowExternal logic does not regress in future changes.

In `@packages/cli/src/commands/architecturePolicy.ts`:
- Around line 172-193: The getConsumedArgumentIndexes function uses indexOf to
find flag positions, which only returns the first occurrence of a flag. When
duplicate flags like --root or --manifest appear multiple times (e.g., --root a
--root b), only the first flag and its value are marked as consumed, causing the
second flag's value to be incorrectly treated as a positional argument. Replace
indexOf with lastIndexOf for the --manifest and --root flags in the first loop
to capture the last occurrence of each flag, ensuring all duplicate flag values
are properly marked as consumed and not confused with positional arguments.

In `@packages/create-croco-app/src/generator.ts`:
- Around line 249-258: The ignore patterns in the architecture policy check
configuration are excluding TypeScript test files (*.spec.ts, *.test.ts) but not
their TypeScript JSX equivalents (*.spec.tsx, *.test.tsx). Since the policy
check explicitly includes TSX files, TSX test files are unintentionally being
checked against the policy rules. Add four additional ignore patterns to the
ignore array in both locations: one for "*.spec.tsx" files in apps, one for
"*.test.tsx" files in apps, one for "*.spec.tsx" files in libs/shared, and one
for "*.test.tsx" files in libs/shared. This should be done in the ignore array
around line 249-258 and also in the similar ignore configuration around line
351-360.
๐Ÿช„ Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

โ„น๏ธ Review info
โš™๏ธ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 8ef0adbd-9b0d-46f7-b3af-22aaf45ef1ff

๐Ÿ“ฅ Commits

Reviewing files that changed from the base of the PR and between 0a1ebbd and 8457dc3.

โ›” Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
๐Ÿ“’ Files selected for processing (33)
  • .changeset/static-architecture-policy.md
  • README.md
  • croco.arch.json
  • docs/architecture-policy.md
  • docs/package-catalog.json
  • docs/package-docs-baseline.json
  • docs/package-docs-report.md
  • docs/problem-code-registry.json
  • package.json
  • packages/architecture-policy/README.md
  • packages/architecture-policy/package.json
  • packages/architecture-policy/src/index.ts
  • packages/architecture-policy/src/tests/ArchitecturePolicy.spec.ts
  • packages/architecture-policy/tsconfig.json
  • packages/cli/package.json
  • packages/cli/src/commands/architecturePolicy.ts
  • packages/cli/src/commands/root.ts
  • packages/cli/src/index.ts
  • packages/cli/src/tests/architecturePolicyCheck.spec.ts
  • packages/cli/vitest.config.ts
  • packages/create-croco-app/src/generator.ts
  • packages/create-croco-app/src/tests/e2e-generation.spec.ts
  • packages/create-croco-app/src/tests/templates-build.spec.ts
  • packages/create-croco-app/templates/saas/package.json.hbs
  • packages/docs/src/content/docs/en/guides/getting-started.mdx
  • packages/docs/src/content/docs/en/index.mdx
  • packages/docs/src/content/docs/en/reference/problem-recovery-cookbook.md
  • public-api-surface.snapshot.json
  • scripts/architecture-policy-check.mts
  • scripts/create-croco-app-generated-smoke.mts
  • scripts/package-entrypoint-smoke.mts
  • scripts/package-quality-report.mts
  • scripts/tests/package-entrypoint-smoke.spec.ts

Comment thread packages/architecture-policy/package.json Outdated
Comment thread packages/architecture-policy/src/index.ts Outdated
Comment thread packages/architecture-policy/src/tests/ArchitecturePolicy.spec.ts
Comment thread packages/cli/src/commands/architecturePolicy.ts
Comment thread packages/create-croco-app/src/generator.ts
@kang-heewon
kang-heewon force-pushed the fix/931-architecture-policy branch from 8457dc3 to 6f86fb4 Compare June 21, 2026 12:36
@kang-heewon
kang-heewon merged commit e7c4ce7 into trunk Jun 21, 2026
8 checks passed
@kang-heewon
kang-heewon deleted the fix/931-architecture-policy branch June 21, 2026 13:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant